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**Method of and Software FORMoMiTOBiN6Di(aTAL Information** 

FIELD O F mVENTTON 

Teds invention relates to a method of and software for monitoring digital information, 
having particular appKcation to securing digital information against unauthorised access and/or 
use. Monitoring digital information in the context of the present invention is to be taken to inchide 
5 addressing security aspects as weU as providing behavioural and/or market anafysis functionality 
in respect ofthe usage of the digital information. The invention has particular appUcationto use 
in respect of a plurality of computers linked to one another in a network, but it will be appreciated 
that the invOTtion is not limited to this field of use. 

BACKGRnTny n apt 

10 Digital information, generally in the form of program or data ffles stored on digital data 

storage device such as. for example, a hard disk drive, CD-ROM or such like, can represent a 
significant investment in time and money to develop. For the purposes ofthe present specification, 
unless the context indicates otherwise, the terms "digital information", "data fife", "software" and 
the like are to be taken to inchide both executabfe program files and the like and non-executabfe 

15 data files and the like. The term "serial number" is to be taken to consist of potentially both 
numeric and non-numeric characters. Tue term "cod^-breaking methods" is to be taken to inchide 
such activities commonly known as "liacldng" and the like. 

Accessing digital information has been improved with the devetopment of computer 
networks, particularly tiie Intemet, with computers using modem appHcations such as web 
2 0 browsers and the like. However, there is a temptation for users to pilfer information or abuse the 
ready availabiUty. Moreover, in some circumstances, privacy and/or security issues would make 
it undesirabfe to make digital information freely available, or at lease, availabfe in an unconhrolled 
manner. 

In the case of the Intemet and the World Wide Web in particular, although some websites 
25 have restricted entiy, once a user has accessed the information, that information is vuhierable to 
being taken and used in a way that could at best be undesirable, and at worst, illegal Even in the 
case of webpages being generated from database or encrypted sources, once the information has 
been assembled and downloaded, it is vulnerable to abuse. Moreover, a strategy consisting solely 
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of authenticating users leaves such unencrypted information vulnerable to unauthorised access by 
hackers or the like. 

File transmission protocols may include an ability to restrict the functionality of the client 
computer receiving digital information in order to provide some form of protectioa For example, 
in the case of web browsers, it is possible to embed extOTsions, applets or the like to prevent a 
5 client computer from, for example, printing a file, saving it to disk, or partly disabling a mouse 
or a keyboard. However, these measures can often be circumvented if the user of the client 
conq)uter is suflSciently experienced. 

The Internet has also become a common route by which softvme is purchased. Even when 
software is purchased through normal retail channels, once it has ben purchased, the software is 
10 often reqxxired to be registered with the software producer or retailer as part of the installation 
process in order to decrease the likelihood of unauthorised copying of the software. However, 
such protection systems may sometimes be circumvented, or may be diflBcult to implement. 

Present methods of monitoring digital ioformation do not provide substantial ability to 
perform behavioural or market analysis in respect of usage of that digital information. Neglected 
15 aspects include, for exanple, tracking piracy attempts, geographic distribution and usage, network 
location, sex, age and occupation, contact details and methods, tracking production, sale, 
distribution chain and user registration stqps, user feedback, post-registration usage, PC-platform 
age, PC-hardware usage and marketing profile. 

There are some systems which rely on hardware profiles for registration, security checks, 
20 product activation or such like. For example, one proposed for product activation has been 
proposed by Microsoft in the Windows XP operating system for microconq)uters. However, such 
systems have hmitations. There are some systems which incorporate what may be described as 
"terminal services software!' which in operation set up nnjltq)le sessions with clients and 
sometimes oreate a virtual image of every client on the server in a similar feshion to oldw multq)le 
25 virtual storage systans having aplurality of dumb terminals connected to a mainframe coirqputer. 
Because only a limited amount of information is transmitted between the clients and the server, 
and all users are running applications on the same hardware, hardware signature based security 
systems have difficulty protecting applications on such systems. 
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Software product activation systems sometimes cause problems for users if the software 
is to be moved fi-om one machine to another. Re-registration is often required, but usually only 
if an uninstall code has been generated by uninstalling the software product from the original 
machine. Most activation systems cannot accommodate circximstances where hardware failure 
requires reinstallation and reactivation of software from original media onto a different machine 
5 from that where it was originally installed. 

The present invention aims to provide method of and software for monitoring digital 
information which alleviates one or more of one of the aforementioned disadvantages. The 
invention also aims to provide digital information protected by the method and/or software of the 
invention Other aims and advantages of the invention may become apparent from the following 
10 description. 

DISCa^OSURE OF THE INVENTION 

With the foregoing in view, this invention in a first aspect resides broadly in a method of 
monitoring digital information including: 

creating a secure wrapper aroxmd the digital information using a method selected from: 

^ ^ a first wrapper method including directly embedding a first executable protection 

software portion in the digital information; or 

a second wrapper method including linking a second executable protection 
software portion to the digital information by way of an apphcation program 
interface (API); or 

2 ° a third wrapper ntiethod inchiding modifying the digital information and embedding 

a third executable protection software portion in the modified digital information; 

each of the first, second and third executable protection software portion including a 
specific performance portion operable by a user to perform one or more specific performance 
tasks, the or at least one of the specific performance tasks inchxding a hardware environment 
25 check; 
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selecting one of fhe first second or third wrapper methods according to the software and 
development platform of the digital infomnation, the accessibility of the source code of the digital 
information, and/or the level of monitoring required; 

executing selected wrapper method by way of the first, second or third executable 
protection software portions including the steps of: 

5 intercepting access to the digital information; 

checking that at least one of the specific performance tasks has been performed, including 
the hardware environment check has been performed; and 

validating whether or not the hardware environmrat corresponds to the hardware 
environment which has been previously checked. 

10 Once the monitoring has been or is being performed in accordance with the invention, 

access to the digital information may be provided ia a manner transparent to the user that the 
digital information has been or is being monitored. 

In a second aspect, the present invention resides broadly in a method of monitoring digital 
information including: 

15 creating a secure wrapper aroimd the digital inforofiation by embedding an executable 

protection software portion in the digital information, the executable protection software 
iacluding a specific performance portion operable by a user to perform one or more specific 
performance tasks, the or at least one of the specific performance tasks including a hardware 
environment check; 

2 0 the secure wrapper being operable to: 

intercept access to the digital information; 

check that at least one of the specific performance tasks, including the 
hardware environment check has been performed; and 



25 



validate whether or not the hardware environment corresponds to the 
hardware environment which has been previously checked. 
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In a third aspect, the present invention resides broadly in a method of monitoring digital 
ioformation including: 

creating a secure wrapper around ihe digital information by including linking an executable 
protection software portion to the digital information by way of an application program inter&ce 
(API), said executable protection software portion including a specific performance portion 
5 operable by a user to perform one or more specific performance tasks, the or at least one of the 
specific performance tasks includiug a hardware environment check; 

the secure wrapper being operable to: 

intercept access to the digital information; 

check that at least one of the specific performance tasks, including the 
1 0 hardware environment check has been performed; and 

validate whether or not the hardware environment corresponds to the 
hardware environment which has been previously phecked. 

In a fourth aspect the present invention resides broadly in a method of monitoring digital 
information including: 

15 creating a secure wrapper aroimd the digital information by modifying the digital 

information and embedding an executable protection software portion in the modified digital 
information; 

the executable protection software includiag a specific performance portion operable by 
a user to perform one or more specific performance tasks, the or at least one of the specific 
2 0 performance tasks including a hardware environment check; 

the secure wrapper being operable to: 

intercept access to the digital information; 

check that at least one of the specific performance tasks has bcCTL 
performed, including the hardware enviroimient check has been performed; and 
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validate whether or not the hardware environment corresponds to the 
hardware environment which has been previously checked. 

Once the monitoring has been or is being performed in accordance with the invention, 
access to the digital information may be provided in a manner transparent to the user that the 
digital information has been or is being monitored. 

5 Preferably, the specific performance includes an exchange of codes between a cUent 

computer and a server conqputer operatively connected to the server contq[>uter. Preferably, the 
exchange of codes includes: 

the uploading of a code corresponding to the hardware environment of the cUent 
coniputer; 

10 the uploading of a code corresponding to the digital information, such as, for example, a 

unique serial number or the like issued for that particular example of digital information; and 

the downloading of a code corresponding to a key for entry into the client coniputer for 
accessing the digital information on an ongoing basis or for a selected countable xmit. 

In a prc&^rred form, the countable unit is time, and periods of time may be divided or 
1 5 quantized to provide a selected period of time. However, other countable units may be used, such 
as traffic counters, site access coimts or such like. 

hi the case of the digital information being in the form of non-executable data, such as, for 
example, a webpage, database, text file, spreadsheet, or the like, it is preferred that the third 
wrapper method be selected. 

2 0 Preferably, one of the specific performance tasks includes checking whether an operating 

S3^tem is operating having multiple virtual storage. If such a system is detected, the method 
substitutes a system user account check instead of the hardware environment check, and perforais 
the remainder of the method using the user account information instead of the hardware 
ioformation. 



In a fifth aspect, the present invention resides broadly in a method of monitoring digital 
information in the form of a non-executable, browser-readable code and/or content including: 
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creating a mapping table capable of translating and preserving text, aU object paths, 
extensions and such like within a single container or file structure to fonn a mapped file; 

converting the mapped file into an executable file structure to form a conversion file; 

encrypting the conversion file to form an encrypted file 

embedding protection software as herein described to enable dynamic decryption of 
S selected content of the encrypted file when correctly registered. 

For example, where the non-executable file is in the form of a file in hypertext markup 
language (HTML), possibly including applets, MIME for non-text content, or other non-text 
inclusions, the data file is converted into an executable file which provides the exchange of codes 
described herein. In such form, it is fiuther preferred that the exchange of codes includes the 
10 downloading of an encryption key, and the executable file includes information encrypted 
according to the key. The method in this case includes the encoding of the digital information 
using the key generated for the particular client computer, such that the same digital information 
may be provided in a different form, being encoded with a different encryption k^, for each client 
conq)uter connected to the server. 

In a sixth aspect, the present invention resides broadly in a system architecture for 
providing monitoring of digital information, including: 

primary web server means for serving a computer network; 

a plurality of client computers operatively connected to the primary web server means by 
way of the network; 

one or more registration server means operatively coimected to the primary web server 
and operatively connectible to the client computers by way of the network; 

registration support means operatively associated with the primary web and registration 
server means for supporting the fimctionality of the primary web and registration server means; 

wherein the primary web server means is operable to provide validation of a call firom any 
client computer, tracking the client computer and if required redirecting the call; 
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and wherein the registration server means is opCTable to provide registration of each client 
conq)uter when operatively connected thereto by way of the network; 

the operative association of the registration support means inchiding alternative means of 
communicating information between the client contiputers and the registration server means for 
client cont^uters which are not connected thereto and the registration support means being 
5 operable to provide or fimctional in providing for registration of any client computer by way of 
the alternative means of communicating. 

Optionally, if the primary web server is, or becomes, inoperable, the method may include 
validating a call from any client conoputw and tracking the client con5)uter. The alternative means 
of communicating could include, for example, provision for web fomi, entiail, telephone, fax or 
1 0 postal transmission of relevant information instead of direct online communication. 

Preferably, tiie architecture further includes data analysis means operatively connected to 
the registration server means for analysing the registration, usage or other billing, behaviomral, 
demographic and/or market analysis of information received from the client computers in the 
registration and usage of digital information. 

In a seventh aspect, the present invention resides broadly in a method of protecting 
software, the method insol&r as the installation and registration of the software including the steps 
of: 

installing the software on a coiiq)uter; 

after installing the software, running the software for a first time; 

upon the running of the software on the con:5)uter, generating an installation code from 
the hardware profile of the computer; 

after generating the "installation code, requesting a xmique serial number from an 
authorisation source, the request inchiding providing the hardware profile of the computer; 

after requesting the serial number, registering the software with a registration authority 
using the serial number and installation code; 
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receiving a positive or negative reply from the registration authority; 

upon the receipt of a negative repty from the registration authority, returning to the step 
of requesting a serial number and following the steps thereafter; 

upon the receipt of a positive reply from the registration authority, receiving a registration 
key from the registration authority and saving the registration key on the con5)uter, whereupon 
5 the software may be executed insofar as its fimctional performance is concerned; 

the method insofar as the post-registration running of ttie software including the fiirther 
steps of: 

running the software on the computer; 

upon the runniog of the software on the conqjuter, generating an installation code from 
10 the hardware profile of the conputer; 

after the hardware profile has been generated, comparing the registration key with the 
hardware profile; 

upon the matching of the hardware profile with the registration key, permitting the 
software to executed iasofer as its fimctional performance is concerned; 

15 upon the feihire of the hardware profile to match the registration key, denying permission 

for the software to executed insofar as its fimctional performance is concerned, 

Preferabfy, the computer is a client computer operably connectible to a server computer, 
and the serial nunober and registration key are uploaded and downloaded (as the case may be) 
between the cUent and server computers when operably coimected to one another. 

20 In an eighth aspect, the present invention resides broadly in a method of monitoring digital 

information including: 



adding a protection software portion; 
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modifyiog the protection software portion so as to mask its identifying characteristics and 
behaviour. For example, operative portions of program code maybe embedded into other code 
which is, apparently, functional, but never called by the actual program in its operation 

In a ninth aspect, the present invention resides broadly in a method of monitoring digital 
information having a protection software portion as hereinbefore described, including; 

adding a specific performance portion for checking for the presence of code-breaking 
methods; 

checking for the presence of code-breaking methods to provide a check result; and 
modifying the behaviour of the protection software portion in accordance with the check 

result. 

Where software which has been registered with a registration server is to be transferred 
fix)m one machine (the original machine) to another (the new machine), the method, system and 
software of the present invention provides fixnctionality to: 

check to determine whether the software is registwed; 

accommodate uninstallation of the software from the original machine; 

communicate with the registration server to re-activate the registration of the software on 
the new machine; 

if the registration server cannot be contacted, a transfer key is generated which provides 
evidence that the ^plication has been successfixlly uninstalled, ttie transfer key being required to 
be provided as part of a new installation to activate the software. 

The transfer key may be either manual, involving a support call, or electronic. 
Sophisticated attenq)ts to create a copy of the hard drive contents before uninstaffing are 
protected against by limiting the number of transfers that are permitted in a particular period of 
time. 

Where software is to be tracked without necessarily iavoking the security aspects, user 
25 information is requested to be entered into a form, but if the iofotmation is not entered, the 
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software is peraiitted to start, but will proinpt the user every time it is run to provide information. 
If requested ioformatiou is entered, the software will not ask for user information every time it 
is run unless set to do so according to some measurable quantity, such as time, number of starts, 
quantity of data processed or such like. The number of copies of software installed without 
tracking to and from a point of origin may be tracked, monitoring each and every instance that 
5 the software is installed, obviating the requirement for a serial number to be entered. Alternatively, 
number of copies of software installed, but in this exan^le, with tracking to and from a point of 
origiamay be tracked, still monitoring each and every instance that the software is installed, but 
in this case, requiring a serial number to be entered. It can be seen that in each case, information 
can be requested to provide feedback and/or marketing informatioa 

10 BWEF DESCRIPTION OF THE DRAWINrtf: 

In order that the invention may be more readily xmderstood and put into practical effect, 
reference will now be made to the acconq)anying drawings which illustrate a preferred 
embodiment of the invention and wherein:- 

Fig, 1 is a flowchart illustrating a method of monitoring digital information 
15 according to the invention; 

Fig. 2 is a flowchart iOustrating a method of converting browser readable digital 
iaformation according to the invention; and 

Fig. 3 is a diagrammatic representation of an architecture jfor monitoring digital 
information according to the invention. 

20 DETAILED DESCRTPTTQN OF THE DRAWINGS 

The method 10 illustrated has in two stages, an installation and registration stage 1 1 and 
a post registration stage 20. In the first stage, a user installs software at step 12 and runs the 
software at step 13 using the normal commands of the con^uter upon which the method of the 
present invention is to be performed. At step 14, the running of the software generates an 
2 5 installation code from the hardware profile of the computer. The software then requests a serial 
number and other details, such as name, address, contact details and the like at step 15. The 
registration process is then instituted in accordance with flie procedures hereinbefore described 
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at step 16, usually by way of an Internet connection to a web server computer. If the registration 
is successful at step 17, a registration key is saved at step 18, otherwise, if specific security 
parameters have been exceeded at step 20, the software exits at step 21 or returns the user to step 
15. Upon the saving of the registration key in step 1 8, the appUca^ion program installed by the 
foregoing steps is executed at step 19. 

In the second stage at 22, for each subsequent nmning of the program at step 19 
described, a sequence of prerequisite steps are performed in accordance with the invention, these 
being described hereinafter. The software is run at step 23, whereupon an installation code is 
generated from the hardware profile of the con^uter at step 24 in a similar fashion to that of step 
14 above. The saved registration key at step 18 is con5)ared to that required of a computer having 
the matching installation code at step 25. At step 26, a negative match rejects fiirther execution 
of the program at step 27, but a positive permits the program to continue at step 28 in a similar 
fashion to that of step 19 described above. 

The method 30. for protection of webpages described in Fig. 2, includes tiie following 
steps. The raw HTML and associated browser-readable code and/or content is received at step 
31. A mapping table is applied to the code at step 32. The mapped data is converted into an 
executable file at step 33, which is then encrypted at step 34. The software protection described 
herein is embedded into the encrypted file at step 35 to produce protected software at step 36. 

The system architecture 50 illustrated in Fig. 3 includes a primary web server 51 
operath^fy comiected to a primary registration server 53, a secondary registration server 54 and 
a tertiary registration server 55. A cKent computer 52 (of which there would nomially be a 
plurality, one only being shown for clarity) is operatively connected to the web server and the 
registration servers. Communication may be routed automatically through a primary web server 
51 or manually via a web form 56. The architecture provides for removal of the primary web 
server ,in which case, the client computer 52 os operatively connected to the registration server 
53, 54 or 55. Registration support shown at 60 is operatively associated with the registration 
server, normally by telephone at 61 but the architecture also provides alternative communication 
methods, inchiding email 65, postal service 62 and fex transmission 63, The fax communication 
may be routed through a fex server 64 or received in hardcopy by registration support. The 
architecture also provides for monitoring other than security such as data gathering at 70, which 
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includes billing and behavioural, demographic and market analysis functions at 71 for production 
of reports and/or invoices at 72. 

In order that the invention nfiay be more readily xmderstood and put into practical effect, 
reference will now be made to an oxaxnph of the invention in use. The first time an application 
program is started on a client con^uter, the protection software will generate an installation code 
5 which is based on a number of parameters unique to the computer platform on which the 
application is installed. 

A unique serial number, entered by the client, and the installation code are supplied to the 
registrar. A mathematically-related unlock or registration key, which can only be generated by the 
registrar with the specific key-generation program for that application, is returned to the client. 
1 0 The registrar may be an Internet-connected server of a software tool administered by a support 
person. If the Internet registration server option is chosen, entry of the registration key is 
automatic and transparent to the user once the user has entered the required information. 

Until the registration key has been successfiilly entered, each time the application is 
started, it will request the key. Once the key has been entered, it will be compared with the 
15 parameters described above. If the software is copied to another computer, it will again follow 
the registration process as the new system parameters, typically unique to each computer, will not 
match. 

ii relation to HTML and related content, the method of the present iavention addresses 
a special challenge for the protection as the content itself is not an executable program in its own 

2 0 right and can in the absence of the protection afforded by the method of the present invention be 
read, modified and displayed by numerous editors and browsers. The method of the present 
invention converts HTML code, including java script, XML and any other type of browser- 
readable code and/or content to an encrypted, protected, executable file structure while preserving 
all normal browser fimctionaKty and compatibility. Content can be protected on CD-ROM or any 

2 5 ottier media, including remotely referenced content on a web server. In the case of a web server, 
conv^ed and encrypted files are held on the web server. The files are viewed via the protected 
local client software which decrypts the files prior to viewing. 
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Utflising web-based content enables authors to update content on the server without any 
modification to client code while still maintaining protection. 

For exannple, the usee starts the program for the first time and is requested to enter their 
contact details, unique serial number supplied with the purchased software and optional marketing 
and demographic information. The protection software of the present invention generates a unique 
installation code based on selected parameters unique to the computer platform on which the 
application is installed. If Intemet connection is present, the above information is uploaded to the 
registration server. If an Intemet connection is not present, the user is guided through the options 
of registration by post, fax or telephone to the manual registrar*(at 60 in Fig. 3). The client 
receives the required Registration Key or if the registration criteria are not valid a rejection is 
issued and the software will not fiinction. 

In the case of automated registration by way of the Intemet or the like, inchiding client 
direct or via a web form, the primary web server validates the client information, adds IP address 
tracking information and forwards the request to the first available registration server. If the 
primary web server option is not used, the first available registration server validates the client 
1 5 information, adds IP address tracking information and processes the request. The registration and 
tracking information is captured in the database and compared with the registration history. If the 
specific registration criteria are met, a valid registration key is sent to the cUent. If not, the request 
is rejected. All registration details in the database are automatfcally synchronised with each 
registration server. 

20 In the case of manual registration, the registration details are received by a nominated 

representative via telephone, fex or post. Registration information is captured with software 
specifically designed for the registrar. The registrar software is itself protected by the software 
protection method of the present invention and can be dynamicaUy controlled in terms of its ability 
to be registered itself and to register software usersr 

2 5 The registrar software captures registration information in the database and compares it 

with the registration history, via a secure Intemet link to the registration server. If the specific 
registration criteria are met, a vaKd registration key is returned to the client via their nominated 
method of receiving the registration details (email, telephone, fex, post, etc). If the specific 
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registration criteria are not met, the request is rejected and a corresponding message is returned 
to the client via their nominated method of receiving the registration details. If successfiil, the user 
manually enters the supplied registration details into the protection software screen provided. 

In performing the method of the invention, several options maybe selected for software 
registration. As a first example, only a specific number of registrations per serial number may be 
5 permitted by the software vendor. As a second exatxqple, registrations within an allowable range 
of serial numbers may be pre-allocated by the software vendor. As a third example, registration 
for a trial or demonstration period registration may be time limited. As a fourth example, the 
number of times that registrations maybe limited. As a fifth example, the PC-platform parameters 
used to uniquely identify the installation can be varied to suit the strer^ or uniqueness required 

10 by the software vendor. As a sixth exaix5)le, the number of registrations allowable on the same 
PC platform may be limited as identifi.ed in the fifth exan^le. As a seventh example, concurrent 
licensing may be provided for. A specific number of licences can be shared across any Internet- 
connected PC's. The software may be installed on any PC but win not run without first validating 
with the registration server that a licence is available for use. As an eighth option, licence 

15 transferral may be provided by permitting a serial number to be released for re-use by the user 
after validation of licence cancellation on that platform. 

In pOTfoiming the method of the invention, several options naay be selected for behavioural 
and market analysis. As a first example, providing behavioural and^or market analysis in respect 
of the nature and number of piracy attempts by comparing all successfiil and unsuccessful 

20 registration attempts for specific PC platforms, clients, networks and software distributions. As 
a second example, providing real-time behavioural and/or market analysis in respect of the 
geographic and network distribution and usage of software. As a third example, providing real- 
time behavioural and/or market analysis in respect of the sex, age and occupation of clients. As 
a fourth example, providing targeted marketing to specific clients and client groups utilising 

25 contact details, preferred contact methods and other monitoring information. As a fifth exan^le, 
providing real-time behavioural and/or market analysis in respect of sales, distribution chain and 
user registration steps including timing and volumes. As a sixth example, providing real-time 
behavioural and/or market analj^is in respect of post-registration usage including frequency, 
duration and fimctionality. As a seventh example, providing real-time behavioural and/or market 
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analysis in respect of the PC platform type and age used. As an eighth example, providing real- 
time behavioural and/or market analysis in respect of product specific xiser feedback. 

The method, ^em and software of the present invention may be used to provide 
software tracking fonctionality without necessarily invoking the security functionality. Such an 
appUcation permits recording of retails of each installation of software for tracking purposes. 
Software will be permitted to run, but will prompt the user to register each time the software is 
started, until the user has registered the software. Preferably, registration is via a network, such 
as the Intemet. Such a tracking arrangement allows the collection and analysis of end-user data. 
Depending on the configuration, data for tracking and analysis of specific distributions to and 
from a point of origin may be collected. Behaviours, such as, for exaiiq>le, piracy attenq)ts, 
sharing, demographic, product feed back and marketing information may be collected. 

Although the invention has been described with reference to specific examples, it will be 
appreciated by persons skiUed in the art that the invention may be embodied in other forms 
without departing from the broad scope and ambit of the invention as claimed by the following 
claims. 



